When you search for “DigiLocker” on Google Play, you anticipate finding the official document wallet application provided by the government. Typically, this is the case. However, in recent weeks, alongside the legitimate app, there have been several applications that have no business being there.
Security analysts and users have been reporting the presence of fraudulent DigiLocker imitations that are circulating once more. These applications do not serve the purpose of storing documents. Instead, they are designed to extract personal information and transfer money from bank accounts.
They appear credible. They incorporate the tricolour. They feature the Ashoka Chakra. Their names are sufficiently similar to the authentic app to be mistaken for it at first glance. Some have accumulated thousands of downloads, and a few even possess reviews that do not immediately arouse suspicion.
Only after you have installed them does the trouble begin
Most of these applications start by requesting permissions that are illogical for a document application. They seek access to SMS, calls, and sometimes even screen recording. Subsequently, they prompt you to “verify” your identity using your Aadhaar, PAN, or phone number.
From that point, events escalate rapidly
Certain versions discreetly access your OTP messages. Others overlay your screen and capture your keystrokes. In some instances, individuals have been directed to counterfeit UPI or banking pages that closely resemble the authentic ones. You believe you are logging in, but in reality, you are relinquishing your personal information.
In numerous cases, individuals have reported missing funds on the same day, sometimes within mere minutes.
What enables this scam to succeed is not sophisticated coding; it is trust
DigiLocker is a legitimate and widely utilized government service. People do not approach it with skepticism. Furthermore, in 2026, as everything from EPF claims to KYC updates appears to necessitate yet another application, an increasing number of individuals are seeking these tools.
This scenario also does not resemble a traditional “you’ve been hacked” situation. There are no alarming messages or warnings. Many individuals only become aware that something is amiss when they access their banking application and observe an unfamiliar debit.
There are methods to identify these counterfeit applications, but it is essential to take your time
The authentic DigiLocker application is released by the National e-Governance Division of the Government of India. The fraudulent versions typically have slightly altered names, unusual developer accounts, or email addresses that appear unofficial.
Permissions can also serve as a clue. A document application should not require access to your SMS or the ability to view your screen. Furthermore, DigiLocker will never request your UPI PIN or banking password.
If you suspect that you have installed one of these applications, refrain from opening it again. Disconnect your internet connection. Uninstall the application. Immediately check your bank and UPI applications.
Change your passwords using a different device. Contact your bank to report the incident. If any funds are missing, file a complaint on the cybercrime portal. Timeliness is crucial in these situations. The sooner you report it, the higher the chances of mitigating the damage.
Regarding how these applications continue to bypass security — Google does remove them. However, the individuals behind these apps are quick. New versions emerge under different names. Some remain available long enough to ensnare thousands of users before being taken down.
This presents an uncomfortable reality: even app stores can no longer be considered entirely secure
The overarching lesson is straightforward. Digital scams no longer appear dubious. They seem legitimate. They are positioned right alongside the genuine applications you rely on.
In 2026, exercising caution with links is insufficient. You must also be vigilant about what you choose to install.
